I'm confused where cybersec sits in your sandwich analogy. If every time you sold a sandwich someone could use it to steal all the money in your business you'd probably need to know how to prevent reverse sandwich cashouts.
I'm not talking about advanced, domain specific cybersec. I don't expect every developer to have the sum total knowledge of crowd strike... But in a business environment I don't see how a developer can not consider cybersec in the code they write. Maybe in an org that is so compartmentalized down that you only own a single feature?
It's fair to point out that not all development is Internet connected, but ~58% of developers work in web dev.
5% in desktop apps
3% in mobile
2.4% in embedded
And then of the remaining I'd be shocked if few of their domains excluded Internet facing devices.
https://survey.stackoverflow.co/2023/#section-developer-roles-developer-type
But you're right to point out development isn't a monolith. Professionally though: anyone working in a field where cybersecurity is a concern should be thinking about and knowledgeable of cybersec.